That gap is exactly what Failure Mode and Effects Analysis (FMEA) is built to close. It turns "we think this will work" into a documented, scored, defensible risk decision — one that holds up whether you're facing a customer, a registrar, or a production line that just went down.
This guide covers what FMEA actually is, the types you'll encounter, the step-by-step process, a worked example, and how to keep it from becoming a shelf document your next auditor flags as "not maintained."
Key Takeaways
- FMEA scores potential failure modes before they reach the customer or the auditor
- Design FMEA (DFMEA) and Process FMEA (PFMEA) are the two core types most teams need
- Severity, Occurrence, and Detection scores combine into a Risk Priority Number (RPN)
- Treat FMEA as a living document, revisiting it whenever design, process, or regulation changes
- A stale FMEA is just an unopened binder; keep it current to serve as real audit evidence
What Is Failure Mode and Effects Analysis (FMEA)?
FMEA is a systematic, team-based method for identifying how a product or process could fail, why it would fail, and how serious the consequences would be. ASQ defines it as a structured, step-by-step approach for identifying and prioritizing possible failures in a design, manufacturing process, product, or service, before that failure ever happens.
Four building blocks make up every FMEA:
- Failure mode — the specific way something could fail (a weld cracks, a field goes blank, a sensor misreads)
- Effect — what happens downstream because of that failure, for the next process step, the system, or the customer
- Cause: the design or process reason behind the failure mode, not just a restatement of the effect
- Analysis — scoring severity, occurrence, and detection to rank which risks need attention first
You'll find FMEA used across design engineering, process and manufacturing engineering, quality assurance, and reliability programs. It's especially common in organizations governed by standards like AS9100D, ISO 9001, and ISO 13485, where documented risk-based thinking isn't optional.
Types of FMEA
Two types cover most of what quality teams actually need day to day:
- Design FMEA (DFMEA): focuses on product and design risk, covering material properties, geometry, tolerances, and interface failures, all analyzed before a part ever hits production
- Process FMEA (PFMEA) — focuses on manufacturing or service delivery risk, typically organized around the 6Ms: Man, Method, Material, Machine, Measurement, and Mother Nature (environment)
Beyond those two, a handful of specialized variants exist for specific use cases: FMEA-MSR (Monitoring and System Response) under AIAG-VDA, System FMEA, Machinery FMEA, and Software FMEA. Unless you're deep in automotive or complex systems engineering, DFMEA and PFMEA will cover the vast majority of your risk analysis needs.
Traditional (RPN) vs. AIAG-VDA FMEA
For decades, teams calculated a Risk Priority Number by multiplying Severity × Occurrence × Detection. The June 2019 AIAG-VDA FMEA Handbook introduced Action Priority (AP) as a replacement in many industries. This table-based High/Medium/Low ranking keeps severity visible, rather than letting it get diluted by low occurrence or detection scores.
Which method you use often comes down to what your customer or industry standard requires, so check your governing procedure before you pick one.
Why FMEA Matters for Quality and Compliance
FMEA converts guesswork into documented, defensible risk decisions. That distinction matters most under audit pressure, when "we thought it would be fine" isn't an acceptable answer.
Here's what a well-maintained FMEA actually buys you:
- Prevents defects and nonconformances from reaching production or the customer in the first place
- Reduces cost of poor quality by catching design and process gaps early, before scrap, rework, or warranty claims pile up
- Produces documented risk evidence that satisfies AS9100D, ISO 9001, and ISO 13485 audits, even though none of these standards names FMEA specifically
- Builds cross-functional alignment between design, quality, and manufacturing before disagreements turn into finger-pointing after a failure
- Supports continuous improvement by staying "alive," updated as designs change instead of filed away after the initial review
That last point trips up more teams than any other. An FMEA that hasn't been touched since the original design freeze signals that risk management stopped the day the design was frozen.
How FMEA Works: The Step-by-Step Process
FMEA breaks into practical stages your team actually executes, not a one-and-done worksheet. The most common mistake at every stage? Assigning severity, occurrence, and detection scores from gut feel instead of data or genuine team consensus.
Define scope and assemble the team. Set the boundary first: one process, one design, one system. Then pull a cross-functional team: design, quality, manufacturing, and key suppliers if the failure could originate there. FMEA built by one person in a conference room rarely catches what a diverse team would.
Identify potential failure modes. Brainstorm every way a function or process step could fail. Use existing data (warranty returns, scrap logs, prior nonconformances) where you have it. Where you don't, lean on team knowledge and honest speculation about what could go wrong.
Determine effects and rate severity. For each failure mode, trace the downstream consequence. A skipped inspection step doesn't just create a paperwork gap; it might let a defective part reach a customer. Score severity on a 1-10 scale, where 10 represents the most hazardous outcome.
Identify causes and rate occurrence. Trace the root cause behind each failure mode, then score how frequently that cause is likely to occur. This isn't the same as scoring the failure itself; it's scoring the likelihood the cause shows up in the first place.
Evaluate current controls and rate detection. Look at what's already in place to catch the failure: inspections, sensors, checklists, sign-offs. Score how likely that control is to actually catch the problem before it reaches the customer. Don't assume; test it if you can.
Calculate RPN and prioritize actions. Multiply Severity × Occurrence × Detection to get your RPN, then rank failure modes accordingly. But don't stop there. A severity rating of 9 or 10 demands attention regardless of the total RPN, because a high-severity, low-frequency failure can easily get buried under a modest total score. Review severity independently before finalizing which actions get resourced first.
FMEA in Action: A Simplified Example Walkthrough
Here's a generic, cross-industry example so you can map the logic onto your own process. Imagine a data-entry step in an order process, where a rep manually keys customer shipping addresses into an order system.
Failure mode 1: Wrong ZIP code entered.
- Severity: 6 (shipment delay, customer complaint)
- Occurrence: 5 (manual entry, no validation)
- Detection: 7 (no automated check catches it)
- RPN: 6 × 5 × 7 = 210
Failure mode 2: Order quantity transposed (10 entered as 100).
- Severity: 8 (major overship, inventory and billing errors)
- Occurrence: 3 (less frequent, but happens)
- Detection: 8 (currently caught only if the customer calls)
- RPN: 8 × 3 × 8 = 192
Notice the trap here: failure mode 1 has the higher RPN, but failure mode 2 carries higher severity. A team that skips validating the detection score (or assumes an existing "control" like a spot-check actually works without testing it) would prioritize the wrong fix.
The team assigns the highest-priority action to failure mode 2: add an automated quantity-range validation in the order system, flagging any entry more than 20% above the customer's historical average. Owner: IT systems lead. Target date: 30 days.
After implementation, the team recalculates. Detection drops from 8 to 3 (the system now flags outliers automatically). New RPN: 8 × 3 × 3 = 72, confirming the risk was meaningfully reduced, not just addressed on paper.
This is the exact recalculation step the QMS Learning AI Workbench automates, instantly updating RPN scores and generating the audit-ready FMEA record once a new control is in place.
How QMS Learning Helps Teams Apply FMEA With Confidence
Most FMEA training teaches the worksheet. It doesn't teach the judgment call: knowing when FMEA is the right tool versus when it's the wrong one.
QMS Learning was built by Will Trikha, a 20-year quality and operations practitioner who has written over 1,000 audit findings and closed twice that number as a quality manager. That practitioner background shows up directly in how the platform's AI Workbench handles FMEA.
The Method Router diagnoses a live compliance problem first, then selects the right tool (FMEA, 5-Why, CAPA, or Gap Analysis) and auto-generates the audit-ready artifact. Its logic reflects real judgment:
- New process or design: routes to FMEA for prospective risk assessment
- Recurring defect from an existing supplier or process: skips FMEA and routes to 5-Why and CAPA instead, since FMEA doesn't close failures that already happened
The Manager Dashboard then exports training completion, exam outcomes, and Workbench-generated artifacts as a single Audit-Evidence Package — the kind of documentation a registrar can review without a follow-up phone call.
That Audit-Evidence Package only holds up if FMEA keeps working after the audit ends. FMEA delivers value as an ongoing discipline, not a one-time worksheet exercise.
Treat it like a working document that gets revisited as designs, processes, and regulations evolve, and it becomes your best piece of audit evidence. File it away after the first review, and it becomes exactly the kind of "not maintained" finding auditors are trained to spot.
Frequently Asked Questions
What is quality FMEA?
FMEA is a proactive risk tool that identifies and prevents nonconformances before they reach the customer or an audit. It documents failure modes, causes, and controls to keep risk decisions defensible.
What are the 5 steps of the FMEA process?
Identify potential failure modes, determine effects and rate severity, identify causes and rate occurrence, evaluate current controls and rate detection, then calculate RPN to prioritize corrective action.
What are the three types of FMEA?
The three types are DFMEA (design), PFMEA (process), and FMEA-MSR (monitoring and system response). DFMEA and PFMEA are the two most commonly used, while FMEA-MSR is a specialized addition applied mainly in automotive and complex systems work.
What is RPN in FMEA and how is it calculated?
RPN equals Severity × Occurrence × Detection, each scored on a 1-10 scale. Teams use it to rank failure modes and decide which risks need action first — though a high severity score should always get independent review.
When should a team conduct an FMEA?
Conduct one during new or updated product designs, before introducing a new manufacturing process, when an existing process changes, and periodically for existing products or services to catch new risks as conditions shift.
Is FMEA required for AS9100D or ISO 9001 compliance?
Neither standard names FMEA explicitly as mandatory. Both require documented, risk-based thinking, and a well-maintained FMEA satisfies that requirement as objective evidence during an audit.
